我正在尝试在同一台计算机上设置具有相互SSL身份验证的WCF服务和客户端。
我已经:
为服务器和客户端创建了证书,并将这些证书放置在LocalMachine证书存储中。服务器和客户端的私钥位于“个人”存储中,而公钥位于“受信任的人”存储中。
我已经配置了一个WCF服务和客户端,每个都指定了自己的证书引用,并设置其他方的证书引用以使用
<authentication certificateValidationMode="PeerTrust" trustedStoreLocation="LocalMachine" />
注意:服务器证书是发给机器名称的,由客户端调用的服务URL是'https:\tokenservice\tokenservice.svc'
通过此配置,我期望客户端能够安全地连接到服务,每一端都会从“受信任的人”存储中解析证书,但我得到了以下错误,表明证书验证失败:
[AuthenticationException: The remote certificate is invalid according to the validation procedure.]
所以这并不像我预期的那样工作。有人能指出任何错误吗?或者我的期望是不正确的吗?
下面是WCF配置:
<?xml version="1.0"?>
<configuration>
<system.web>
<compilation debug="true" targetFramework="4.0" />
</system.web>
<system.serviceModel>
<bindings>
<wsHttpBinding>
<binding name="CertificateForClient">
<security mode="Transport">
<transport clientCredentialType="Certificate"/>
</security>
</binding>
</wsHttpBinding>
</bindings>
<behaviors>
<serviceBehaviors>
<behavior name="CertificateBehaviour">
<!-- To avoid disclosing metadata information, set the value below to false and remove the metadata endpoint above before deployment -->
<serviceMetadata httpGetEnabled="true"/>
<!-- To receive exception details in faults for debugging purposes, set the value below to true. Set to false before deployment to avoid disclosing exception information -->
<serviceDebug includeExceptionDetailInFaults="true"/>
<serviceCredentials>
<clientCertificate>
<authentication certificateValidationMode="PeerTrust"
trustedStoreLocation="LocalMachine" />
</clientCertificate>
<serviceCertificate findValue="CN='ServerCertificate which is machine name'"
storeLocation="LocalMachine" storeName="My"
x509FindType="FindBySubjectDistinguishedName" />
</serviceCredentials>
</behavior>
</serviceBehaviors>
</behaviors>
<services>
<service name="TokenService.TokenService" behaviorConfiguration="CertificateBehaviour">
<endpoint contract="TokenService.ITokenService"
binding="wsHttpBinding" />
<endpoint contract="IMetadataExchange"
binding="mexHttpBinding" address="mex">
</endpoint>
<host>
<baseAddresses>
<add baseAddress="https://tokenservice" />
</baseAddresses>
</host>
</service>
</services>
<serviceHostingEnvironment multipleSiteBindingsEnabled="true" />
</system.serviceModel>
<system.webServer>
<modules runAllManagedModulesForAllRequests="true"/>
</system.webServer>
</configuration>
客户端配置:
<system.serviceModel>
<behaviors>
<endpointBehaviors>
<behavior name="ClientBehaviour">
<clientCredentials>
<clientCertificate storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectDistinguishedName" findValue="CN=TokenClient"/>
<serviceCertificate>
<authentication certificateValidationMode="PeerTrust" trustedStoreLocation="LocalMachine"></authentication>
</serviceCertificate>
</clientCredentials>
</behavior>
</endpointBehaviors>
</behaviors>
<bindings>
<wsHttpBinding>
<binding name="ClientBinding">
<security mode="Transport">
<transport clientCredentialType="Certificate"/>
</security>
</binding>
</wsHttpBinding>
</bindings>
<client>
<endpoint address="https://tokenservice/TokenService.svc"
behaviorConfiguration="ClientBehaviour"
binding="wsHttpBinding" bindingConfiguration="ClientBinding"
contract="TokenService.ITokenService" name="ToolClient">
<identity>
<dns value="MachineName" />
</identity>
</endpoint>
</client>